security-baseline-ubuntu

Production-grade Security Baseline & Hardening Guide for Ubuntu 24.04/26.04 LTS. Kernel isolation, Emergency Panic Button, custom AppArmor/Firejail 0.9.80 and Bubblewrap, Rootless Docker, AIDE integrity checks, Lynis audits, and secure hardware (YubiKey/Ledger). 17 languages.

🛡️ Advanced OS Hardening: Security, Privacy & Anonymity Guide

An enterprise-grade, comprehensive guide dedicated to host-level hardening, operational security (OpSec), and digital self-defense. This project is localized into 17 languages to empower journalists, human rights defenders, and infosec professionals globally.

🌐 Select Your Language

📌 Project Overview

This guide provides step-by-step instructions to transform a standard Linux distribution into a resilient, high-security workstation capable of mitigating advanced physical, supply-chain, and network-level threats. It focuses strictly on open-source solutions, host-level isolation, compliance verification, and radical reduction of the OS attack surface.

Key Security Vectors Covered:

• Hardware & Boot Hardening: Implementing strict bootloader password protection to mitigate Evil Maid attacks, enforcing pre-boot security standards, and establishing secure physical configuration lines.

• DMA & Memory Protection: Kernel-level IOMMU programming (iommu.passthrough=0) to block malicious Direct Memory Access via Thunderbolt/USB4/PCIe interfaces, combined with low-level kernel tuning to eliminate memory data remanence.

• Telemetry & Component Purging: Sanitizing the host completely via automated Bash scripting—purging built-in Canonical telemetry, completely disabling the Snapd ecosystem, and removing vulnerable print/discovery services (Avahi/CUPS).

• System Integrity & Security Auditing: Deploying a cryptographic baseline for system files via AIDE (File Integrity Monitoring), hunting rootkits with Rkhunter, and validating the overall defensive posture using automated compliance stress-tests via Lynis.

• Sandboxing & Mandatory Access Control (MAC): Enforcing granular application containment by deploying strict AppArmor security policies and isolated execution environments via Firejail and Bubblewrap (covering utilities, local LLMs like LM Studio, and core dev tools).

• Network Perimeter Isolation: Engineering bulletproof MAC address spoofing, disabling the IPv6 stack, and building an uncompromising UFW firewall architecture with a strict Kill Switch to completely eliminate traffic leaks outside the virtual boundary of the tun0 VPN interface, layered with Portmaster firewall integration for real-time application-level egress visualization.

• Browser Hardening: Extreme browser core modification via about:config and deployment of specialized user.js files to neutralize WebRTC leaks, enforce strict DoH Mode 3 + ECH, and block advanced cross-site tracking.

• Hardware Token Integration: Elevating physical access controls to the hardware level by binding display managers, interactive shells, and local KeePassXC credential vaults directly to YubiKey 5 cryptographic tokens. Features a hardware-disconnect session Lock Switch and an advanced kernel-level Kill Switch that triggers cryptsetup luksSuspend to instantly purge master keys from RAM alongside SysRq emergency shutdown upon token extraction.

• Secure Virtualization & Crypto-Asset Protection: Designing secure workflows for isolated guest operating systems, advanced anti-forensic optimization of VDI virtual containers (zero-filling and compression), and sandboxing desktop interfaces for hardware wallets like Ledger Live.

• Data Sanitization & Anti-Forensics: Irreversible localized data destruction using low-level shred/wipe routines, systematic metadata extraction/scrubbing via the MAT2 toolkit, and deployment of custom-compiled communication stacks (Psi+ OMEMO/GnuPG) while mitigating Unicode-based Bidi source code attacks to fortify operational security (OPSEC).

• Censorship Circumvention: Implementing custom proxy workarounds to bypass state-level network blocks on anti-malware signature updates (ClamAV) for users operating under strict internet restriction boundaries (Russia, Iran, etc.).

[!NOTE] Contributions are welcome! If you want to improve a translation, update technical content, or report a bug, please open an Issue or submit a Pull Request. Let's make the digital world safer together.